Nemcio/Gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2025-12-21 15:50:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

vendor: update github.com/go-macaron/session (#5469)

Browse Source 
Fix security flaw reported by c957861129d62331c5704d2f04d11e41.
This commit is contained in:
Unknwon
2018-10-24 09:43:59 -04:00
parent a1098384c0
commit b93079f1c1
5 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
vendor/github.com/go-macaron/session/session.go generated vendored
View File

@@ -18,15 +18,17 @@ package session
import (
"encoding/hex"
"errors"
"fmt"
"net/http"
"net/url"
"strings"
"time"
"gopkg.in/macaron.v1"
)
const _VERSION = "0.3.0"
const _VERSION = "0.4.0"
func Version() string {
return _VERSION
@@ -245,8 +247,8 @@ func NewManager(name string, opt Options) (*Manager, error) {
return &Manager{p, opt}, p.Init(opt.Maxlifetime, opt.ProviderConfig)
}
// sessionId generates a new session ID with rand string, unix nano time, remote addr by hash function.
func (m *Manager) sessionId() string {
// sessionID generates a new session ID with rand string, unix nano time, remote addr by hash function.
func (m *Manager) sessionID() string {
return hex.EncodeToString(generateRandomKey(m.opt.IDLength / 2))
}
@@ -258,7 +260,7 @@ func (m *Manager) Start(ctx *macaron.Context) (RawStore, error) {
return m.provider.Read(sid)
}
sid = m.sessionId()
sid = m.sessionID()
sess, err := m.provider.Read(sid)
if err != nil {
return nil, err
@@ -282,6 +284,12 @@ func (m *Manager) Start(ctx *macaron.Context) (RawStore, error) {
// Read returns raw session store by session ID.
func (m *Manager) Read(sid string) (RawStore, error) {
// No slashes or dots "./" should ever occur in the sid and to prevent session file forgery bug.
// See https://github.com/gogs/gogs/issues/5469
if strings.ContainsAny(sid, "./") {
return nil, errors.New("invalid 'sid': " + sid)
}
return m.provider.Read(sid)
}
@@ -308,7 +316,7 @@ func (m *Manager) Destory(ctx *macaron.Context) error {
// RegenerateId regenerates a session store from old session ID to new one.
func (m *Manager) RegenerateId(ctx *macaron.Context) (sess RawStore, err error) {
sid := m.sessionId()
sid := m.sessionID()
oldsid := ctx.GetCookie(m.opt.CookieName)
sess, err = m.provider.Regenerate(oldsid, sid)
if err != nil {